4 ms·
The later iterations of Poly1305 removed the need for AES by using a synthetic Salsa20 derived key that is unique per key-nonce input pair.
by colmmacc 8y ago
The later iterations of Poly1305 removed the need for AES by using a synthetic Salsa20 derived key that is unique per key-nonce input pair.
- lvh 8y agoWhoops; you're right of course, but same idea with fewer primitives -- either way, obscure the output of the polynomial MAC with the output of a cipher, so you get the fast MAC that you can reuse multiple times.